Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-835a-arqz-g7h7
Vulnerability ID VCID-835a-arqz-g7h7
Aliases CVE-2024-26280
GHSA-6xwf-xvf3-v459
PYSEC-2024-42
Summary Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-276 Incorrect Default Permissions
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/apache/airflow
https://github.com/apache/airflow/commit/1a96407cd2d76616c1137de288f092d4f3b097fa
https://github.com/apache/airflow/commit/7f10998c17ab9d725bc8671deb4c12d672bfba99
https://github.com/apache/airflow/commit/8324c87e05741e5a673c43b315619a3788bacc2e
https://github.com/apache/airflow/commit/8463ee4f25114a6c5fb2408d6026afe94bdf106d
https://github.com/apache/airflow/commit/f2ea8a3e1753012bfe0d529c9c8be66cf55ca28f
https://github.com/apache/airflow/commit/f4b9cc74976b7df1acbc3c63471b5751b3e2c40c
https://github.com/apache/airflow/pull/37501
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-42.yaml
https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh
CVE-2024-26280 https://nvd.nist.gov/vuln/detail/CVE-2024-26280
GHSA-6xwf-xvf3-v459 https://github.com/advisories/GHSA-6xwf-xvf3-v459
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:21:03.560819+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2024-42.yaml 38.6.0